.env.example

# Core
TOKENHUB_LISTEN_ADDR=:8080
TOKENHUB_LOG_LEVEL=info
TOKENHUB_DB_DSN=file:/data/tokenhub.sqlite?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)

# Vault: encrypted credential storage for provider API keys.
# Set TOKENHUB_VAULT_PASSWORD to auto-unlock at startup (headless mode).
# If not set, unlock interactively via UI or tokenhubctl.
TOKENHUB_VAULT_ENABLED=true
TOKENHUB_VAULT_PASSWORD=

# Providers are loaded from ~/.tokenhub/credentials at startup, or registered
# at runtime via the admin API, tokenhubctl, or UI.

# Routing policy defaults
TOKENHUB_DEFAULT_MODE=normal
TOKENHUB_DEFAULT_MAX_BUDGET_USD=0.05
TOKENHUB_DEFAULT_MAX_LATENCY_MS=20000

# Security & hardening
# TOKENHUB_ADMIN_TOKEN: required for production; protects /admin/v1/* endpoints
# Leave unset to let the server generate a random token (written to ~/.tokenhub/env)
TOKENHUB_ADMIN_TOKEN=
# TOKENHUB_CORS_ORIGINS: comma-separated allowed origins; empty = allow all
TOKENHUB_CORS_ORIGINS=
TOKENHUB_RATE_LIMIT_RPS=60
TOKENHUB_RATE_LIMIT_BURST=120
TOKENHUB_PROVIDER_TIMEOUT_SECS=30

# OpenTelemetry (optional — disabled by default)
TOKENHUB_OTEL_ENABLED=false
TOKENHUB_OTEL_ENDPOINT=localhost:4318
TOKENHUB_OTEL_SERVICE_NAME=tokenhub

# Temporal workflow engine (optional — disabled by default)
TOKENHUB_TEMPORAL_ENABLED=false
TOKENHUB_TEMPORAL_HOST=localhost:7233
TOKENHUB_TEMPORAL_NAMESPACE=tokenhub
TOKENHUB_TEMPORAL_TASK_QUEUE=tokenhub-tasks